Isolating operating system environments in embedded devices

Abstract

A unique embedded system is disclosed that locally operates an application virtual machine (VM) and a system VM in isolation from each other. The application VM executes application-specific code for a given purpose of the embedded system. The system VM executes a host operating system (OS) and various security, compatibility, and updating functions independent of the application VM. Each VM is connected to its own unique hardware on the embedded system to ensure that changes to the application code or the system code do not impact the other.

What is claimed is: 
     
         1 . An embedded system configured to perform application-specific instructions, the embedded system comprising:
 a plurality of hardware components comprising system hardware components and application hardware components;   memory embodied with instructions for creating an application virtual machine (VM) in isolation from a system VM; and   a processing unit configured to only connect the application hardware components to the application VM and only connect the system hardware components to the system VM.   
     
     
         2 . The embedded system of  claim 1 , wherein the application VM comprises an application container that contains an application operating system (OS). 
     
     
         3 . The embedded system of  claim 2 , wherein the application VM includes application code executable to perform the application-specific instructions. 
     
     
         4 . The embedded system of  claim 1 , further comprising:
 an application operating system (OS) running exclusively in the application VM; and   a system OS running exclusively in the system VM.   
     
     
         5 . The embedded system of  claim 1 , further comprising paravirtualized hardware components that are usable by both the application VM and the system VM. 
     
     
         6 . The embedded system of  claim 1 , where the processing unit is at least one of a microprocessor. 
     
     
         7 . The embedded system of  claim 1 , wherein the processing unit is at least one of a system on chip (SoC), microcontroller unit (MCU), or application-specific integrated circuit (ASIC). 
     
     
         8 . The embedded system of  claim 1 , wherein the embedded system is an Internet of things (IoT) device. 
     
     
         9 . The embedded system of  claim 1 , wherein the application hardware components comprise at least one peripheral component. 
     
     
         10 . The embedded system of  claim 1 , wherein the system hardware components comprise at least one of a security processor, flash memory, or a primary network adapter. 
     
     
         11 . An embedded system configured to perform application-specific instructions, the embedded system comprising:
 a plurality of hardware components comprising system hardware components, application hardware components, and paravirtualized hardware components;   memory embodied with instructions for creating an application virtual machine (VM) in isolation from a system VM; and   a processing unit configured to:
 only connect the application hardware components to the application VM application hardware components, 
 only connect the system hardware components to the system VM, and 
 create a real-time container in the application VM for running application code to carry out the application-specific instructions. 
   
     
     
         12 . The embedded system of  claim 11 , further comprising:
 an application operating system (OS) running exclusively in the application VM; and   a system OS running exclusively in the system VM.   
     
     
         13 . The embedded system of  claim 11 , further comprising paravirtualized hardware components that are usable by both the application VM and the system VM. 
     
     
         14 . The embedded system of  claim 11 , where the processing unit is at least one of a microprocessor. 
     
     
         15 . The embedded system of  claim 11 , wherein the processing unit is at least one of a system on chip (SoC), microcontroller unit (MCU), or application-specific integrated circuit (ASIC). 
     
     
         16 . The embedded system of  claim 11 , wherein the embedded system is an Internet of things (IoT) device. 
     
     
         17 . The embedded system of  claim 11 , wherein the application hardware components comprise at least one peripheral component. 
     
     
         18 . The embedded system of  claim 11 , wherein the system hardware components comprise at least one of a security processor, flash memory, or a primary network adapter. 
     
     
         19 . A method for programming an embedded system configured to perform application-specific instructions, the method comprising:
 identifying a plurality of hardware components of the embedded system, the plurality of hardware components comprising application hardware components and system hardware components;   creating an application virtual machine (VM) to run on the embedded system;   creating a system VM to also run on the embedded system in isolation from the application VM;   connecting the application VM to only the application hardware components; and   connecting the system VM to only the system hardware components.   
     
     
         20 . The method of  claim 19 , further comprising:
 receiving an update to a system operating system (OS) executing in the system VM; and   updating the system OS in the system VM without updating software in the application VM.